Differences from Tor Browser #367
Comments
No.
Great. Looking forward to it. I understand there are many similar projects (user.js settings) but it is really difficult to keep track of all of them. For the moment yours is the only one I have had a look at. It is good there is an open bug to discuss all that at Tor but as far as I see it is not really getting a lot of attention. It seems to me important to distinguish between the "regular" browsers and TBB because with regular browsers we have an additional goal - not to share the IP address with 3rd parties. With TBB however there is an additional goal: not to create an easy fingerprint. When testing certain settings in TBB I noticed that the Panopticlick bits raise when supposedly privacy tightening settings are applied (e.g. disabling cookies). Ideally we should come up with a unified |
ghost
mentioned this issue
|
@AnChEv you compared the default settings in Tor. |
|
I have compared the default settings of Tor but with "Security Level" slider set to Safest. I don't know if and how that affects any about:config settings but I think it deserves a more meticulous look because Tor gives a Panopticlick result of 6.57 bits while FF with this |
Good choice. Some settings are changed in an hardened way. |
|
I tested various things today (including setting some values to what they are in Tor) and then running https://panopticlick.eff.org/ Something strange I notice: Any idea why that may be? Except this particular setting, testing in Tor the other ones shared in #365 (comment) don't increase the entropy bits in Tor. So perhaps we can assume they actually add security and privacy? Strangely I can't get FF 58 lower than 9.7 bits with the same Additionally I wonder if it is possible to reduce further the 6.57 bits of Tor... What do you think about all these? |
A dead horse, DNT is greatly ignored and simply makes your browser stand out in the crowd. |
I have highest bits of identifying information on these Browser Characteristics: Of these, some can be spoofed (UA String) or modified, while others are Hardware/OS related [*] Moreover, with less FF users the uniqueness is increasing. |
|
So how did you do the comparison? Because I think there is no point in comparing settings in TBB, that are the same defaults as in Firefox, but only compare the settings they have explicitly set.
True.
I'm afraid we'll never get there. I mean having some kind of consensus on the settings between different projects. |
I know that. But the fact is that Panopticlick result is affected by that setting. So although it is ignored and cannot be trusted as a security measure, it may at least matter as a dimension about privacy.
Are you testing with the same settings which I described?
Compared before/after the custom
A friend used to say: "With computers we must be explicit" :) I tend to agree because we (or at least I) don't know which TBB and FF settings are at their default values, if those default values are exactly the same (or TBB modifies them somehow). Additionally I notice that even with "factory" settings TBB has different (still displayed as default) settings and others which show as modified (although I haven't touched anything). So the point of comparing is to check how settings affect privacy/security in the different browsers and suggest better defaults.
That's not even the purpose. I am rather hoping to sort out the best bundle of settings. For the moment it is going well. |
Settings are close to the ones I previously linked here. |
|
Then obviously you are not testing with what I test, so the result will be different. |
|
Not good, due to the hardware and OS. Fonts can be spoofed at system level: https://github.com/da2x/fluxfonts |
|
What has hardware and OS to do with that? AFAIK fonts can be detected only through JS or flash. In my settings JS is disabled and I don't have flash installed. If you are testing with JS or some plugins that wouldn't be a meaningful test in the first place. Right? |
|
Yes, these test pages have this flaw: sometimes you have to open up your defences for the tests to actually work.
Screen size and system fonts (different from OS to OS, different if office suites installed or not): #367 (comment) I had a look at @AnChEv Differences list (on top) and then I left only the entries with It's 174 differences and I am not amused at what I see regrading Tor preferences. |
|
What are you talking about? I haven't opened up any defenses. The Panopticlick works without JS and I don't know how it may be possible to detect your desktop resolution if JS is disabled. I am getting confused by your words.
It seems Tor is not that tightened, right? |
My fault, I haven't done that test for some months, sorry! TBB isn't tightened at all. 👍 for your efforts! |
|
Let's tighten it then! :) |
It was a Makefile target I made for pretty much this purpose.
The Tor tweaks come from I made a few additional targets:
E.g.: This way we don't need to comb through all the settings that come from Firefox defaults. |
|
I am not an expert in |
Well in this case, it's just a method of calling an infernal shell one-liner that performs the diffing. You can see it running the one-liner in the second line of the example. The Did this answer your question? |
|
Yes but what is And another question: how can I get in a text file everything which I see in about:config in Tor (and in Firefox)? Perhaps if that is possible (say as a CSV) we could compare and experiment further. What do you think? |
|
This bash script wgets this and then diffs with your own file via sed and regex. BTW the gitweb.torproject.org link is a 404 Not Found for me, I see this other one but I don't know if it's the same. |
|
Thanks. 404 here too. |
|
I have to make some space before installing anything, but then I'll get those default preferences. Meanwhile I looked at Orfox and, scattered around many files, there are preferences that allow some google URLs. Tor prefs can be definitely modified for good. |
|
Do you think it would a good idea to create a matrix/table/CSV of settings? I imagine it may have the following columns:
Then hopefully we can come up with the best bundle of tested settings and when new browser versions are released we can simply review what's new and add/update the relevant cells. Perhaps some script may generate a The challenges I see with this:
What do you think? |
|
BTW this may be worth looking at: |
|
I think you should start your own repo with: Preference Name I'll gladly criticise/contribute, then. Diffs between this user.js and the ghacks one has been done before, devs are happily going in parallel on their own paths. |
|
This is new for me but I think I created a repo Could you please check my profile and suggest how to proceed? |
|
👍 There's "Manage topics" below the description, you can populate some keywords. |
|
I will add proper description. But what I am more interested right now is the proper format for the matrix and how to get all preferences and values from the different sources in it. I haven't used git, only svn, so it is really new to me. |
More and more sites are actually preventing injecting tracking scripts like GA when it is enabled 😉 |
It's Tor projects "version of user.js". Their customizations that is.
|
|
@pyllyukko Thank you! Just to clarify: does the first link contain all possible variables or just the ones which Tor customizes? Also how can I get a full list for FF, IceCat (possibly other FF forks too)? |
Only the ones they customize. For list for FF (if I understood correctly), you can run |
Because it is not possible or for some other reason? I am not looking just to diff things but also to learn what each http://kb.mozillazine.org/About:config_entries Where do you (and other similar projects) get info about the undocumented variables and the extra info about the documented ones? |
Because some are prefs about fonts that depend on the OS. Other prefs appear after you install addons/webextensions. These prefs aren't unified for everyone.
|
|
Thanks. Hm, that makes it more and more difficult. Having to dig through tons of info and spending many hours just to get some privacy. I appreciate the hard work you have done so far. I am questioning if I will be able to add anything meaningful in another repo. |
|
A new repo will raise consciousness, Just do it™ |
|
What do you mean by "raise consciousness"? |
We are into a community here.
We are on the same boat, so to speak.
Users may find the repo discussing tor preferences aqnd become aware. |
|
True but becoming an expert in patching deliberately created holes on the boat just because Mozilla "respects user privacy" is not very efficient. We can keep doing this forever, they can play their tricks on us in next versions etc. Life is short, we need something better. |
|
Yes, I don't update so often for those reasons you said above.
https://trac.torproject.org/projects/tor/query?status=!closed&component=Applications%2FTor+Browser |
Because they are scattered all over the place.
Yes, plenty of settings are completely undocumented.
As @Atavic said:
Sometimes it's quite a detective work. If all else fails, we try to interpret FF's source code and see what the settings actually do. |
|
I wonder how come nobody has created a really secure and private FOSS browser, without using a previous code base which is so full of issues and without putting the user in a situation of a detective. If even Tor needs hardening, that is a real shame. |
|
@AnChEv thats because the web technologies grow so fast with new posibilities that are actually wanted by users. |
Security through patching systems which are designed in an insecure way is not efficient. If new functions are needed, that means new design is necessary. Otherwise if one tries to fly with a bike the result is obviously dangerous. |
|
Let me ask you something then: Do you know what will happen tomorror in the whole world? |
|
|
|
not when it is followed by |
|
But that is wrong usage, not that the program per-se is insecure. You can write a computer virus in notepad or vim. That doesn't make the text editor insecure. |
|
/signoff from pointless derail of topic |
|
@AnChEv mozilla devs have their own irc channels, you can follow discussions there. |
I have gone through each and every line of the current version (commit: 456a2b7) and I have compared the variables with those in Tor browser (the default settings in Tor which show up after downloading a clean browser).
I have added a comment at the end of each line
//TOR: <value in tor> (or 'missing' if it is missing in Tor). For variables which have the same values in Tor browser I have not added comments.Can someone please review all this? If any values are considered more private/secure we could probably notify the Tor developers. Otherwise they may change in this
user.js. (I assume there may be values which are simply a preference but still worth a second look).The text was updated successfully, but these errors were encountered: